REMARKS/ARGUMENTS 



Claims 1-24 are pending in the present application. Claims 1-17 are canceled and claim 
18 has been amended. Reconsideration of the claims is respectfully requested. 

I. 35 U.S.C. § 103, Obviousness 

The Examiner has rejected claims 1-24 under 35 U.S.C. § 103 as being unpatentable over 
Boydstun et al. U. S. Patent 6,839,708 (herein Boydstun) and further in view of Pallante U.S. 
Patent Publication No. 2003/0028495 (herein Pallante). This rejection is respectfully traversed. 

Claims 1-17 have been cancelled. Claim 18 has been amended to further clarify the 
distinction of the invention over the cited art. In the final office action, the Examiner stated that 
"[i]t would have been obvious to one of ordinary skill in the art, at the time the invention was 
made, to combine attaching a digital certificate to a service request, as taught by Pallante, with 
the programmable apparatus/web service architecture/computer readable memory/method of 
Boydstun and that "[i]t would have been obvious for such modifications because a digital 
certificate provides assurance that the person requesting service is indeed who they say they are." 

Applicants submit that the claimed invention contains a number of elements that 
cooperate together to perform an authentication using a digital certificate in a way that cannot be 
performed by Boydstun al and Pallante, individually or in combination. Boydstun and Pallante 
cannot perform the claimed authentication because they do not authenticate the digital certificate 
after interception, extract a service client identifier from the digital certificate, and store the 
extracted service client identifier in a memory so that the web service manager can retrieve the 
client identifier and determine whether the client is entitled to receive the services. In other 
words, Applicants' invention does more than just authenticate the request to get through the 
firewall — rather it extracts the client identifier from the digital certificate so that the information 
can be used to access other information about the client to determine whether the client is 
"entitled" to receive the service. For example, if the client has paid for the service, then the 
client would be entitled to the service. Then the request is forwarded to the web service manager 
for processing. The combination of elements that cooperate together as claimed are not present 
in the cited references, either individually or in combination. 
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Support for amended claim 18 is found in the specification as shown in the table below: 



A method of authenticating and authorizing a 
service request sent from a service client from 
a service client through a firewall to a service 
provider, comprising the steps of: 


FIG. 3, firewall 300, service client 310 


using a service request filter, intercepting an 
incoming service request from a service client 
on a communication channel, the service 
request having a digital certificate of the 
service client attached; 


[0011], line 3-4; [0033], line 9 


using the service request filter, authenticating 
the digital certificate with an issuing 
certification authority; 


[0033], line 10 


using the service request filter, extracting a 
service client identifier from the digital 
certificate associated with the service request; 


[0033], line 13 


using the service request filter, storing the 
service client identifier in a memory; 


[0033], line 15 


using the service request filter, forwarding the 
service request to a web service manager; 


[0033], line 21 


at the web service manager, responsive to 
receiving the service request, retrieving the 
service client identifier from the memory and 
sending an authentication request to a service 
client authentication program; 


FIG. 3, [0033], lines 23-23 


responsive to receiving an authentication 
request from a web service manager at the 
service client authentication program, 
matching the service client identifier with a 
service client record; 


FIG. 3, [0033], line 26 


responsive to matching the service client 
identifier with the service client record, 
sending a request to a service authorization 
program for an authorization for the service 
request; 


FIG. 3, [0033], line 28 


at the service authorization program, 
determining if the service client identifier 
associated with the service request is entitled to 
access the service provider; and 


FIG. 3, [0033], line 29-31 


responsive to determining that the service 
client is entitled, returning a service 
authorization to the web service manager; 


FIG. 3, [0033], line 31-32 


at the web service manager, routing the service 
request to the service provider to process the 
request; 


FIG. 3, [0033], line 33 
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responsive to the service provider processing 
the request, returning an output to the web 
service manager. 



FIG. 3; [0033], lines 34-35 



Therefore, Applicants submit that Boydstun and Pallante, individually or in combination, 
are silent as to extracting a service client identifier and then storing the service client identifier in 
a memory so that the service client identifier can be matched with a service client record to 
determine if the service client is entitled to the service. If the Examiner maintains that Boydstun 
et. al, col. 8, lines 17-36 and/or Pallante disclose these limitations, then Applicants respectfully 
request that the Examiner set forth in detail how extraction from a digital certificate of a service 
client identifier is performed and disclosed. 

Applicants submit that the Examiner cannot set forth in detail how extraction from a 
digital certificate is performed by a combination of Boydstun and Pallante because the Examiner 
has not matched specific disclosures in the cited to specific limitations in the claims. Rather the 
Examiner has distilled the invention down to a "gist" or "thrust" and disregards the requirement 
of analyzing the subject matter of the claim "as a whole." W.L Gore & Associates, Inc. v. 
Garlock, Inc., Ill F. 2d 1540, (Fed. Cir. 1983), cert, denied, 469 U.S. 851 (1984). Moreover, 
the extraction is not inherent in the disclosures because "[t]he face that a certain result or 
characteristic may occur or be present in the prior art is not sufficient to establish the inherency 
of that result or characteristic. In re Rijckaert, 9 F.3d 1531, 1534 (Fed. Cir. 1993). "To 
establish inherency, the extrinsic evidence 'must make clear that the missing descriptive matter is 
necessarily present in the thin described in the reference, and that it would be so recognized by 
persons of ordinary skill. Inherency, however, may not be established by probabilities or 
possibilities. The mere fact that a certain thing may result from a set of circumstances is not 
sufficient." In re Robertson, 169 F. 3d 743, 745 (Fed. Cir.1999). 

While Applicants have discussed extraction as a specific example of the deficiency of the 
cited art, the same arguments apply to the whole claim's cooperation of the elements in order to 
get a service request processed in the manner set forth in claim 18. For example, the references 
do not disclose a service request filter as claimed, a web service manager as claimed, or a service 
client authentication program as claimed. 

Therefore, the rejection of claims 18-24 under 35 U.S.C. § 103 has been overcome. 
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II. Conclusion 

It is respectfully urged that the subject application is patentable over Boydstun and 
Pallante and is now in condition for allowance. 

The Examiner is invited to call the undersigned at the below-listed telephone number if in 
the opinion of the Examiner such a telephone conference would expedite or aid the prosecution 
and examination of this application. 

DATE: October 16, 2008 

Respectfully submitted, 



/Rudolf O. Siegesmund/ 

Rudolf O. Siegesmund 
Reg. No. 37,720 
Yee & Associates, P.C. 
P.O. Box 802333 
Dallas, TX 75380 
(972) 385-8777 
Attorney for Applicants 
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